| 12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061 |
- $OpenBSD: patch-src_auth_password-scheme-crypt_c,v 1.4 2016/11/01 14:12:04 sthen Exp $
- Dovecot supports various password schemes, e.g. {MD5}, {SHA1},
- {SSHA512}, {CRYPT}, etc. This is used in two cases:
- 1. Identifying schemes available for 'doveadm pw -s <scheme>' to
- generate a hashed password from user input.
- 2. Deciding which schemes to allow in a password database.
- Entries are stored as {SCHEME}passwordhash; the string from within
- brackets is checked against the list of supported schemes.
- One common scheme is {CRYPT} which passes to the OS crypt() function and
- is often used with LDAP password databases as it's also supported by
- OpenLDAP for its own authentication.
- After DES was removed from crypt(), 'doveadm pw -s CRYPT' started
- segfaulting on OpenBSD. To avoid this Dovecot was changed to
- test-encrypt a password and check that it can be verified,
- if not then that scheme is knocked out. But as well as stopping
- the segfault in case 1, it also prevents it from being used for
- case 2 i.e. verifying passwords.
- Result:
- dovecot: auth: Error: ldap(xyz,11.22.33.44,<asdafasfasdasfsa>): Unknown scheme CRYPT
- This patch re-allows CRYPT as a supported scheme. On OpenBSD it will
- encrypt as blowfish, on other OS it will encrypt as DES. Verification
- will work with whichever password formats are supported by the OS.
- --- src/auth/password-scheme-crypt.c.orig Fri Jan 8 01:04:13 2016
- +++ src/auth/password-scheme-crypt.c Fri Jan 8 01:23:35 2016
- @@ -111,7 +111,12 @@ static const struct {
- const char *salt;
- const char *expected;
- } sample[] = {
- +#ifdef __OpenBSD__
- + { "08/15!test~4711", "$2a$04$0123456789abcdefABCDEF",
- + "$2a$04$0123456789abcdefABCDE.N.drYX5yIAL1LkTaaZotW3yI0hQhZru" },
- +#else
- { "08/15!test~4711", "JB", "JBOZ0DgmtucwE" },
- +#endif
- { "08/15!test~4711", "$2a$04$0123456789abcdefABCDEF",
- "$2a$04$0123456789abcdefABCDE.N.drYX5yIAL1LkTaaZotW3yI0hQhZru" },
- { "08/15!test~4711", "$5$rounds=1000$0123456789abcdef",
- @@ -124,8 +129,13 @@ static const struct {
-
- /* keep in sync with the sample struct above */
- static const struct password_scheme crypt_schemes[] = {
- +#ifdef __OpenBSD__
- { "CRYPT", PW_ENCODING_NONE, 0, crypt_verify,
- + crypt_generate_blowfisch },
- +#else
- + { "CRYPT", PW_ENCODING_NONE, 0, crypt_verify,
- crypt_generate_des },
- +#endif
- { "BLF-CRYPT", PW_ENCODING_NONE, 0, crypt_verify,
- crypt_generate_blowfisch },
- { "SHA256-CRYPT", PW_ENCODING_NONE, 0, crypt_verify,
|
